Explore the latest developments in HTTP Request Smuggling, a powerful attack technique that exploits inconsistencies in HTTP request interpretation. Delve into new variants, defenses, and challenges presented by security researcher Amit Klein at Black Hat. Learn about the history and evolution of this attack method, including its ability to bypass security solutions, poison caches, and hijack user requests. Discover innovative approaches to mitigating these threats, such as the Socket Abstraction Layer (SAL) and Request Smuggling Firewall (RSFW). Gain insights into design goals, function hooking, and implementation challenges on both Windows and Linux systems. Examine new research challenges, including unconventional uses of CR in header names and manipulations of Content-Length values. This comprehensive 43-minute presentation equips security professionals with essential knowledge to understand and defend against evolving HTTP Request Smuggling techniques in 2020 and beyond.
HTTP Request Smuggling in 2020 - New Variants, New Defenses and New Challenges